w3c / w3c/ServiceWorker

Should referer header be included in fetchEvent request object?

Open
#1,723 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Bikeshed
Stars
3.6k
Forks
324
Avg merge
14d 22h
Merged PRs (30d)
1

Description

Are there any reason why referer is not included wit fetchEvent in the Service Worker?

I have this use case where I wanted to block all requests that originated from specific page.

This is actual code that used my library called Wayne, that I was hoping it would work:

importScripts('https://cdn.jsdelivr.net/npm/@jcubic/wayne@0.17.0/index.umd.min.js');

const app = new wayne.Wayne();

app.get('https://*/*', (req, res) => {
    const referer = req.headers.get("Referer");
    const url = new URL(referer);
    if (url.host === 'localhost' && url.pathname == '/') {
        res.fetch(req);
    } else {
        res.json({error: 'Forbidden'}, { status: 403 });
    }
});

I should block every request that was not sent from the home page of localhost. But unfortunately, Referer is not included, so something like this is not possible. At least in Chrome and Firefox.

I was looking at the spec and was not able to find a list of headers or referer.

Was this written somewhere that it should not be allowed to read the referer?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Service Worker specification and the fetchEvent request object, then compare the reported Chrome and Firefox behavior with the header rules described there. Clarify whether Referer should be exposed and document the expected behavior or specification change; the issue provides no repository files or tests to run.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.